0.0
NA
CVE-2024-53677
Apache Struts Path Traversal Vulnerability
Description

File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067

INFO

Published Date :

Dec. 11, 2024, 4:15 p.m.

Last Modified :

Dec. 18, 2024, 1:15 a.m.

Source :

[email protected]

Remotely Exploitable :

No

Impact Score :

Exploitability Score :

Public PoC/Exploit Available at Github

CVE-2024-53677 has a 6 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-53677 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Apache struts
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-53677.

URL Resource
https://cwiki.apache.org/confluence/display/WW/S2-067

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
dustblessnotdust/CVE-2024-53677-S2-067-thread

None

Python

Updated: 1 day, 5 hours ago
1 stars 0 fork 0 watcher
Born at : Dec. 18, 2024, 6:42 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
XiaomingX/CVE-2024-53677-S2-067

A critical vulnerability, CVE-2024-53677, has been identified in the popular Apache Struts framework, potentially allowing attackers to execute arbitrary code remotely. This vulnerability arises from flaws in the file upload logic, which can be exploited to perform path traversal and malicious file uploads.

Python

Updated: 1 day, 13 hours ago
2 stars 0 fork 0 watcher
Born at : Dec. 18, 2024, 2:03 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
c4oocO/CVE-2024-53677-Docker

A Docker-based environment to reproduce the CVE-2024-53677 vulnerability in Apache Struts 2.

Dockerfile Java HTML

Updated: 2 days, 22 hours ago
2 stars 0 fork 0 watcher
Born at : Dec. 17, 2024, 6:42 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
yangyanglo/CVE-2024-53677

None

Python

Updated: 2 days, 17 hours ago
1 stars 1 fork 1 watcher
Born at : Dec. 17, 2024, 2:22 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
TAM-K592/CVE-2024-53677-S2-067

A critical vulnerability, CVE-2024-53677, has been identified in the popular Apache Struts framework, potentially allowing attackers to execute arbitrary code remotely. This vulnerability arises from flaws in the file upload logic, which can be exploited to perform path traversal and malicious file uploads.

Python

Updated: 4 days, 18 hours ago
5 stars 0 fork 0 watcher
Born at : Dec. 13, 2024, 5:42 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
cloudwafs/s2-067-CVE-2024-53677

s2-067(CVE-2024-53677)

Python

Updated: 4 days, 18 hours ago
3 stars 1 fork 1 watcher
Born at : Dec. 12, 2024, 8:30 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-53677 vulnerability anywhere in the article.

  • Cybersecurity News
CVE-2024-49775 (CVSS 9.8): Critical Vulnerability in Siemens UMC Exposes Systems to Remote Exploitation

Siemens has disclosed a critical heap-based buffer overflow vulnerability (CVE-2024-49775) in its User Management Component (UMC), a core element integrated into several of its products. If exploited, ... Read more

Published Date: Dec 20, 2024 (7 hours, 12 minutes ago)
CVE-2024-49775 CVE-2024-53677 CVE-2024-43222 CVE-2024-12254 CVE-2024-11667 CVE-2024-33698 CVE-2024-22039
  • TheCyberThrone
CISA adds BeyondTrust CVE-2024-12356 to its KEV Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.CVE-2024-12356: Command Injection Vulnerability in BeyondTrust PRA and RSO ... Read more

Published Date: Dec 20, 2024 (7 hours, 35 minutes ago)
CVE-2023-34990 CVE-2024-54677 CVE-2024-50379 CVE-2024-12356 CVE-2024-53677
  • Dark Reading
Orgs Scramble to Fix Actively Exploited Bug in Apache Struts 2

Source: ZUMA Press, Inc. via Alamy Stock PhotoA critical, stubborn new vulnerability in Apache Struts 2 may be under active exploitation already, and fixing it isn't as simple as downloading a patch.S ... Read more

Published Date: Dec 19, 2024 (15 hours, 11 minutes ago)
CVE-2024-53677 CVE-2023-50164
  • TheCyberThrone
Fortinet fixes several vulnerabilities including CVE-2023-34990

Fortinet has released patches for vulnerabilities affecting its popular products, including FortiClient VPN, FortiManager, and FortiWLM. These flaws range from password exposure to remote code executi ... Read more

Published Date: Dec 19, 2024 (17 hours, 23 minutes ago)
CVE-2024-50570 CVE-2024-48889 CVE-2023-34990 CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-47575
  • The Register
Critical security hole in Apache Struts under exploit

A critical security hole in Apache Struts 2 – patched last week – is currently being exploited using publicly available proof-of-concept (PoC) code. Struts is a Java-based web application framework wi ... Read more

Published Date: Dec 17, 2024 (2 days, 11 hours ago)
CVE-2024-53677 CVE-2023-50164
  • BleepingComputer
New critical Apache Struts flaw exploited to find vulnerable servers

A recently patched critical Apache Struts 2 vulnerability tracked as CVE-2024-53677 is actively exploited using public proof-of-concept exploits to find vulnerable devices. Apache Struts is an open-so ... Read more

Published Date: Dec 17, 2024 (2 days, 14 hours ago)
CVE-2024-53677 CVE-2023-50164
  • TheCyberThrone
Clop ransomware exploits Cleo Vulnerability in its attacks

The Clop ransomware gang has recently claimed responsibility for a series of sophisticated data theft attacks targeting Cleo, a prominent provider of managed file transfer software. These attacks expl ... Read more

Published Date: Dec 17, 2024 (3 days, 5 hours ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-50623 CVE-2023-0669
  • TheCyberThrone
TheCyberThrone Security BiWeekly Review – December 14, 2024

Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the weeks ending Saturday, November 30, 2024.Jenkins fixes multiple ... Read more

Published Date: Dec 15, 2024 (5 days, 3 hours ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-52338 CVE-2024-54004 CVE-2024-54003 CVE-2024-42327 CVE-2024-47855 CVE-2024-38193 ...+1 more CVE
  • TheCyberThrone
CISA adds Cleo Vulnerability CVE-2024-50623 to KEV Catalog

The US CISA adds Cleo vulnerability to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation reported.Security vendor Huntress was the first to publicize the attacks ... Read more

Published Date: Dec 14, 2024 (6 days, 5 hours ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-8233 CVE-2024-11274 CVE-2024-49112 CVE-2024-53677 CVE-2024-50623
  • TheCyberThrone
Gitlab fixes CVE-2024-11274 and CVE-2024-8233

GitLab has released a crucial security update to address multiple vulnerabilities impacting various versions of its platform. This update, applicable to versions 17.6.2, 17.5.4, and 17.4.6 for both Co ... Read more

Published Date: Dec 13, 2024 (6 days, 22 hours ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-8233 CVE-2024-11274 CVE-2024-49112 CVE-2024-53677 CVE-2024-50623
  • security.nl
Kritiek lek in Apache Struts 2 maakt remote code execution mogelijk

Een kritieke kwetsbaarheid in Apache Struts 2 maakt remote code execution mogelijk en overheidsinstanties roepen beheerders en organisaties op om de beschikbaar gestelde beveiligingsupdate te installe ... Read more

Published Date: Dec 13, 2024 (1 week ago)
CVE-2024-53677 CVE-2023-50164
  • TheCyberThrone
Apache Struts was affected by CVE-2024-53677

Apache Struts framework has been detected with a critical vulnerability that could allow attackers to execute malicious code remotely, posing a significant risk to affected systems.The vulnerability t ... Read more

Published Date: Dec 13, 2024 (1 week ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-8233 CVE-2024-11274 CVE-2024-49112 CVE-2024-53677
  • TheCyberThrone
Splunk addresses CVE-2024-53247 in Secure Gateway

A critical vulnerability identified has been discovered in the Splunk Secure Gateway app, affecting various versions of Splunk Enterprise and the Splunk Cloud Platform.The vulnerability tracked as CVE ... Read more

Published Date: Dec 12, 2024 (1 week ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-53247
  • The Register
Apache issues patches for critical Struts 2 RCE bug

We now know the remote code execution vulnerability in Apache Struts 2 disclosed back in November carries a near-maximum severity rating following the publication of the CVE. According to the National ... Read more

Published Date: Dec 12, 2024 (1 week ago)
CVE-2024-53677 CVE-2023-50164 CVE-2017-5638
  • Cybersecurity News
CVE-2024-53677 (CVSS 9.5): Critical Vulnerability in Apache Struts Allows Remote Code Execution

Developers using the popular Apache Struts framework are urged to update their systems immediately following the discovery of a critical security flaw (CVE-2024-53677, CVSS 9.5) that could allow attac ... Read more

Published Date: Dec 12, 2024 (1 week, 1 day ago)
CVE-2024-53677 CVE-2024-11053 CVE-2024-55563 CVE-2024-8929 CVE-2024-8932 CVE-2024-47533 CVE-2023-50164
  • TheCyberThrone
AuthQuake vulnerability with Microsoft to Bypass MFA

Cybersecurity researchers at Oasis Security have discovered a significant vulnerability in Microsoft’s Multi-Factor Authentication (MFA) system, which they have named AuthQuake.This vulnerability allo ... Read more

Published Date: Dec 12, 2024 (1 week, 1 day ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-43532
  • TheCyberThrone
Apache Superset 4.1.0 released with bug fixes

The Apache Software Foundation has announced the release of Apache Superset 4.1.0 with several bug fixes that could potentially allow attackers to bypass security controls, access sensitive data, and ... Read more

Published Date: Dec 11, 2024 (1 week, 1 day ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-53949 CVE-2024-53948 CVE-2024-53947
  • TheCyberThrone
Google fixes important vulnerabilities with the latest Google Chrome

Google has released updates for its Chrome browser, addressing several security vulnerabilities, including two important vulnerabilities.The first vulnerability tracked as CVE-2024-12381 with a CVSSv3 ... Read more

Published Date: Dec 11, 2024 (1 week, 1 day ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49138 CVE-2024-49112 CVE-2024-12382 CVE-2024-12381 CVE-2024-53677
  • TheCyberThrone
CISA adds CVE-2024-49138 to its KEV Catalog

The US CISA adds Microsoft vulnerability to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation.The vulnerability tracked as CVE-2024-49138 with a CVSS score of 7. ... Read more

Published Date: Dec 11, 2024 (1 week, 2 days ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49138 CVE-2024-49112 CVE-2024-53677
  • Cybersecurity News
CVE-2024-11639 (CVSS 10) – Critical Flaw in Ivanti Cloud Services Application: Immediate Patch Recommended

Ivanti, a leading provider of IT management and security solutions, has released critical security updates for the Ivanti Cloud Services Application (CSA). These updates address vulnerabilities that c ... Read more

Published Date: Dec 11, 2024 (1 week, 2 days ago)
CVE-2024-53677 CVE-2024-11773 CVE-2024-11772 CVE-2024-11639 CVE-2024-53949 CVE-2024-53948 CVE-2024-53947 CVE-2024-53375 CVE-2024-11680 CVE-2024-8963 ...+3 more CVE
  • TheCyberThrone
Exploit Code Released for Microsoft CVE-2024-38193

A critical use-after-free vulnerability, tracked as CVE-2024-38193 with a CVSS score of 7.8, has been discovered in the afd.sys Windows driver that allows attackers to escalate privileges and execute ... Read more

Published Date: Dec 09, 2024 (1 week, 3 days ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-53908 CVE-2024-53907 CVE-2024-38193
  • TheCyberThrone
Django was affected by CVE-2024-53907 and CVE-2024-53908

The Django team has released Django 5.1.4, Django 5.0.10, and Django 4.2.17 versions to address two security vulnerabilities.The first vulnerability tracked as CVE-2024-53907 with a CVSS score of 7.5 ... Read more

Published Date: Dec 08, 2024 (1 week, 4 days ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-53908 CVE-2024-53907 CVE-2024-38193
  • Cybersecurity News
CVE-2024-12209 (CVSS 9.8): WP Umbrella Plugin Vulnerability Exposes 30,000 Websites to Compromise

A critical security vulnerability has been discovered in the popular WordPress plugin, WP Umbrella, which is used by over 30,000 websites. The flaw, identified as CVE-2024-12209 and assigned a CVSS sc ... Read more

Published Date: Dec 08, 2024 (1 week, 5 days ago)
CVE-2024-53677 CVE-2024-53949 CVE-2024-53948 CVE-2024-53947 CVE-2024-12209 CVE-2024-53375 CVE-2024-11680 CVE-2024-8856 CVE-2024-27821
  • TheCyberThrone
SonicWall addressed half a dozen vulnerabilities in SMA 100 series

SonicWall has released patches for several (six) vulnerabilities impacting its SMA 100 series SSL-VPN products. These flaws range from path traversal issues inherited from the Apache HTTP Server to cr ... Read more

Published Date: Dec 07, 2024 (1 week, 6 days ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-53703 CVE-2024-53702 CVE-2024-45319 CVE-2024-45318 CVE-2024-40763 CVE-2024-38475
  • Cybersecurity News
Black Basta Resurgence: Social Engineering Campaign Delivers Zbot, DarkGate, and Custom Malware

The notorious Black Basta ransomware group is back, employing sophisticated social engineering tactics and deploying advanced malware payloads in their latest campaign. According to a detailed analysi ... Read more

Published Date: Dec 06, 2024 (2 weeks ago)
CVE-2024-53677 CVE-2024-53949 CVE-2024-53948 CVE-2024-53947 CVE-2024-53375 CVE-2024-11680 CVE-2024-27821 CVE-2024-21412
  • TheCyberThrone
SailPoint IdentityIQ affected by CVE-2024-10905

SailPoint IdentityIQ has been affected by a critical vulnerability, that could allow sensitive data exposureThe vulnerability tracked as CVE-2024-10905 with a CVSS score of 10.0, stems from improper a ... Read more

Published Date: Dec 05, 2024 (2 weeks ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-10905 CVE-2024-51378
  • TheCyberThrone
CISA Adds CyberPanel Flaw CVE-2024-51378 to KEV Catalog

The CISA has warned about a critical vulnerability in CyberPanel tracked as CVE-2024-51378, is being actively exploited by attackers to deploy ransomware and added to the known exploited vulnerability ... Read more

Published Date: Dec 05, 2024 (2 weeks ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-8785 CVE-2024-10905 CVE-2024-51378
  • TheCyberThrone
POC Exploit released for WhatsUp Gold CVE-2024-8785

Security researchers have published a proof-of-concept (PoC) exploit for CVE-2024-8785 with a CVSS score of 9.8, a critical remote code execution vulnerability affecting Progress WhatsUp Gold,A critic ... Read more

Published Date: Dec 05, 2024 (2 weeks, 1 day ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-12053 CVE-2024-8785 CVE-2024-51378
  • TheCyberThrone
Google Patches CVE-2024-12053 in Chrome

Google has released patches for a high severity vulnerability in its popular  Chrome web browser residing within the V8 JavaScript engine and allow attackers to execute arbitrary code on users’ system ... Read more

Published Date: Dec 04, 2024 (2 weeks, 1 day ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-42448 CVE-2024-53677 CVE-2024-12053 CVE-2024-8785
  • TheCyberThrone
CISA KEV Catalog Update Part I – December 2024

The US CISA has added the below vulnerabilities to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitation.CVE-2023-45727 Tracked as CWE-611, North Grid Proself Enterp ... Read more

Published Date: Dec 04, 2024 (2 weeks, 2 days ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-42448 CVE-2024-53677 CVE-2024-11667 CVE-2024-11680 CVE-2023-45727
  • TheCyberThrone
IBM fixes multiple vulnerabilities including CVE-2024-49803

IBM has  released patches for multiple vulnerabilities, that could lead to a remote code execution to hard-coded credentials and privilege escalation that potentially compromising sensitive data and d ... Read more

Published Date: Dec 03, 2024 (2 weeks, 2 days ago)
CVE-2024-54677 CVE-2024-50379 CVE-2024-49112 CVE-2024-53677 CVE-2024-49806 CVE-2024-49805 CVE-2024-49804 CVE-2024-49803

The following table lists the changes that have been made to the CVE-2024-53677 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    Dec. 18, 2024

    Action Type Old Value New Value
    Changed Description File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 and migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
  • CVE Modified by [email protected]

    Dec. 16, 2024

    Action Type Old Value New Value
    Changed Description File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0, which fixes the issue. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067 File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0 migrate to the new file upload mechanism https://struts.apache.org/core-developers/file-upload . You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Dec. 12, 2024

    Action Type Old Value New Value
    Added CWE CWE-434
  • New CVE Received by [email protected]

    Dec. 11, 2024

    Action Type Old Value New Value
    Added Description File upload logic is flawed vulnerability in Apache Struts. This issue affects Apache Struts: from 2.0.0 before 6.4.0. Users are recommended to upgrade to version 6.4.0, which fixes the issue. You can find more details in  https://cwiki.apache.org/confluence/display/WW/S2-067
    Added CVSS V4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:A/V:C/RE:L/U:Red
    Added Reference https://cwiki.apache.org/confluence/display/WW/S2-067
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-53677 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-53677 weaknesses.

NONE - Vulnerability Scoring System
: